Configure SSO with Microsoft Entra ID

Published

July 31, 2026

Connect your organization’s Microsoft Entra ID (formerly Azure AD) tenant to ValidMind so your users can sign in with single sign-on (SSO), using the identity provider (IdP) your IT team already manages.

This guide is for customers using the ValidMind Platform cloud (SaaS) offering who want to bring their own identity provider. Microsoft Entra ID is currently the identity provider ValidMind supports for self-service SSO on our multi-tenant cloud.

This is a shared setup

You configure the application registration in your own Entra tenant, then send ValidMind a handful of non-secret values so we can enable SSO for your organization. There’s no client secret to exchange — see Why no client secret?.

Prerequisites

You are logged in to ValidMind.
You are a Customer Admin in ValidMind, or you’re working with someone who is.¹
You have Application Administrator (or Global Administrator) access to your organization’s Microsoft Entra ID tenant.
You know the URL your organization uses to reach ValidMind (for example, https://mycompany.prod.validmind.ai/).

¹ Manage permissions

Step 1: Register an application in Entra ID

Sign in to the Microsoft Entra admin center with your Entra administrator account.
Go to Identity > Applications > App registrations, then click New registration.
Give the application a name, such as ValidMind SSO.
Under Supported account types, select Accounts in this organizational directory only (Single tenant) unless your organization specifically needs multi-tenant sign-in.
Under Redirect URI, select Single-page application (SPA) as the platform, and enter the URL your organization uses to access ValidMind, for example https://mycompany.prod.validmind.ai/.
Click Register.

ValidMind’s login flow uses the Authorization Code Flow with PKCE as a public client — it never uses a client secret. Registering under Web instead of SPA will cause sign-in to fail with a CORS or token-response error.

You don’t need to configure a Front-channel logout URL, an “Expose an API” section, an Application ID URI, or any Microsoft Graph API permissions. ValidMind doesn’t implement a front-channel logout receiver — when a user logs out, ValidMind redirects the browser to Entra ID’s own logout endpoint (using the redirect URI already registered in step 5), which ends the Entra ID session directly. ValidMind also validates the sign-in (ID) token directly and never calls back into Entra ID or Graph.

Step 2: Configure the claims Entra ID sends to ValidMind

ValidMind reads the following information from the ID token Entra ID issues after sign-in:

What ValidMind needs	Claim(s) Entra ID can supply (in priority order)
Email address	`email`, then `upn`, then `preferred_username`
Display name	`name`, then `given_name` and `family_name`, then falls back to email
Group membership (for role/group mapping)	`groups`

In your app registration, open Token configuration and click Add optional claim.
Select token type ID, then check email, upn, given_name, and family_name. Click Add.

If prompted to turn on the Microsoft Graph email permission for these claims to appear, accept the prompt.
Click Add groups claim.
- Select Security groups (or All groups, if you also want directory roles or distribution groups available for mapping).
- Under Customize token properties by type, the default is to emit each group’s Group ID (an object ID, not its display name) in the ID token. You can leave this as the default, or select a different format such as sAMAccountName if your groups are hybrid-synced from on-premises Active Directory — note the format you choose, since you’ll enter matching values in ValidMind in Step 4.
- Click Add.

More than 200 group memberships?

Entra ID only includes a user’s group memberships directly in the token up to a limit (200 for JWTs). Users who belong to more groups than that receive an “overage” claim instead of a groups claim, which breaks role/group mapping for them. If your users typically belong to many groups, keep the security groups used for ValidMind role mapping to a small, dedicated set. See Microsoft’s documentation on the groups overage claim for details.

Step 3: Send ValidMind your application details

Once your app registration is configured, open a support ticket or email support@validmind.com with:

Your Directory (tenant) ID and Application (client) ID, both shown on the app registration’s Overview page.
Confirmation that the redirect URI is registered under the Single-page application platform.
Which format your groups claim uses (object ID or another identifier), from Step 2.
Optionally, any email domains you’d like sign-in restricted to (for example, yourcompany.com), as an extra safeguard.
Whether you’d like Group Sync enabled in addition to Role Sync — role sync maps Entra groups to ValidMind roles, group sync additionally maps Entra groups to ValidMind groups.²

² Manage groups

None of these values are secrets, so a support ticket or email is fine — there’s no client secret or certificate involved.

ValidMind will confirm once Entra ID SSO (and role/group sync, if requested) has been enabled for your organization.

Step 4: Map Entra groups to ValidMind roles

Once ValidMind has enabled sync for your organization, a Customer Admin can map Entra groups to ValidMind roles without ValidMind’s involvement:

In the left sidebar, click Settings.
Under Organization, select Authentication.
Under OIDC Role Mappings, click Add Mapping and enter:
- The group value exactly as it appears in your groups claim (typically an object ID, unless you customized the claim format in Step 2).
- The ValidMind role that group should map to.
If Group Sync is enabled for your organization, repeat under OIDC Group Mappings to map Entra groups to ValidMind groups.
Click Save Mappings.

Example:

Use the group’s object ID, not its display name

Enter the value exactly as Entra ID sends it in the groups claim — normally the group’s object ID (a GUID), not the group’s display name.

Entra security group (object ID)	ValidMind role
`4b6b3f2a-1234-4c9a-8b21-9e2f5a7c1d3e` (Data Scientists)	Developer
`9d1e7c44-5678-4f3b-9a10-2b6d8e4f7c92` (Model Risk)	Validator
`f2a83b17-9abc-4de5-8f60-3c1a6b9d4e75` (IT Admins)	Customer Admin

Step 5: Test sign-in

Log out of ValidMind, if you’re logged in.
Go to your ValidMind login page. You should be redirected to the Microsoft sign-in screen.
Sign in with an Entra ID account that belongs to one of the groups you mapped.
Confirm you’re redirected back to ValidMind, logged in, and that your role matches what you’d expect based on your group membership.

Why no client secret?

ValidMind’s frontend is a single-page application that authenticates directly with Entra ID using the Authorization Code Flow with PKCE. This is the flow Microsoft recommends for browser-based apps, and it doesn’t use or store a client secret at all — which is also why the app must be registered under the Single-page application platform rather than Web in Step 1.